CLAIMS 



WHAT IS CLAIMED IS : 

1. A method for identifying unsolicited electronic mail messages in a 
computer network, comprising: 

receiving an electronic mail message; 
removing non-static data from the electronic mail message; 
generating a checksum based on data remaining within the electronic mail 
message; 

comparing the generated checksum with a database containing checksums 
for previously identified unsolicited messages; and 

identifying the electronic message as an unsolicited message if the 
generated checksum matches one of the database checksums. 

2. The method of claim 1 wherein generating a checksum comprises 
generating individual checksums for portions of the remaining data. 
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3. The method of claim 2 wherein the portions comprise lines of data. 

4. The method of claim 2 wherein comparing a checksum comprises 
comparing checksums starting with one of the portions at the end of the remaining 

5 data and working backwards through the data. 

5. The method of claim 1 wherein removing non-static material comprises 
removing forwarding information. 

6. The method of claim 1 wherein removing non-static material comprises 
removing headers. 

7. The method of claim 1 wherein removing non-static material comprises 
removing end-of-line characters. 

8. The method of claim 1 further comprising deleting the electronic mail 
message if the message is identified as an unsolicited message. 
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9. The method of claim 1 further comprising at least temporarily storing 
the electronic message if the message is identified as an unsolicited message. 

10. The method of claim 1 further comprising forwarding the electronic 

5 message to an intended recipient if the message is not identified as an unsolicited 

message. 

11. The method of claim 1 further comprising updating the database with 
new checksums. 

12. The method of claim 1 1 wherein the database is updated based on 
checksums generated from electronic messages received and identified as an 
unsolicited message. 
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13. A system for identifying unsolicited electronic mail messages in a 
computer network, comprising: 

a message modifier operable to remove non-static data from an electronic 
mail message; 

a checksum generator operable to generate a checksum based on data 
remaining within the electronic mail message; 

a database containing checksums previously identified for unsolicited 
messages; and 

a detector operable to compare the generated checksum with the database 
and identify the electronic message as an unsolicited message if the generated 
checksum matches one of the database checksums. 

14. The system of claim 13 wherein the detector is configured to generate 
individual checksums for portions of the remaining data. 

15. The system of claim 14 wherein the portions comprise lines of data. 
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16. The system of claim 14 wherein the detector is configured to compare 
the generated checksums starting with one of the portions at the end of the data 
and working backwards through the data. 

17. The system of claim 13 wherein the database is configured to receive 
updates. 

1 8. A computer program product for identifying unsolicited electronic 
mail messages in a computer network, comprising: 

code that receives an electronic mail message; 

code that removes non-static data from the electronic mail message; 

code that generates a checksum based on data remaining within the 
electronic mail message; 

code that compares the generated checksum with a database containing 
checksums for previously identified unsolicited messages; 

code that identifies the electronic message as an unsolicited message if the 
generated checksum matches one of the database checksums; and 

a computer readable medium that stores said computer codes. 
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19. The computer product of claim 18 wherein the computer readable 
medium is selected from the group consisting of CD-ROM, floppy disk, tape, 
flash memory, system memory, hard drive, and a data signal embodied in a carrier 
wave. 

20. The computer product of claim 18 further comprising code that 
generates individual checksums for portions of the remaining data. 

21. The computer product of claim 20 further comprising code that 
compares the generated checksums starting with one of the portions at the end of 
the data and works backwards through the data. 
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